Hide Navigation Hide TOC

Potential Excel.EXE DCOM Lateral Movement Via ActivateMicrosoftApp (551d9c1f-816c-445b-a7a6-7a3864720d60)

Detects suspicious child processes of Excel which could be an indicator of lateral movement leveraging the "ActivateMicrosoftApp" Excel DCOM object.

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Potential Excel.EXE DCOM Lateral Movement Via ActivateMicrosoftApp (551d9c1f-816c-445b-a7a6-7a3864720d60)	Sigma-Rules	Distributed Component Object Model - T1021.003 (68a0c5ed-bee2-4513-830d-5b0d650139bd)	Attack Pattern	1
Remote Services - T1021 (54a649ff-439a-41a4-9856-8d144a2551ba)	Attack Pattern	Distributed Component Object Model - T1021.003 (68a0c5ed-bee2-4513-830d-5b0d650139bd)	Attack Pattern	2